---
title: "Updating WordPress opened a hole for seconds; a firewall logged 18,500 probes in 21 hours"
summary: "WordPress 7.1.4 of 28 October, Wordfence’s count of attack attempts and CISA’s 3 November listing: how the update race works, who is exposed and what to check, as of 4 November."
url: https://www.thetechbag.com/blog/wordpress-update-window-exploited-cisa-3-days
format: Note
desk: "Security"
area: "Threats & vulnerabilities"
region: Global
published: 2026-11-04
facts_checked: 2026-11-04
author: TechBag (The TechBag Journal)
tags: ["WordPress","CVE-2026-119977","WordPress 7.1.4","race condition","TOCTOU","Wordfence","CISA KEV","BOD 26-04","forensic triage","web application firewall","patch management","cPGuard","CERT-In","eMudhra"]
cover: https://www.thetechbag.com/blog/covers/wordpress-update-window-exploited-cisa-3-days.png
---

# Updating WordPress opened a hole for seconds; a firewall logged 18,500 probes in 21 hours

*WordPress 7.1.4 of 28 October, Wordfence’s count of attack attempts and CISA’s 3 November listing: how the update race works, who is exposed and what to check, as of 4 November.*

Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-04 · Facts checked 2026-11-04 · Canonical: https://www.thetechbag.com/blog/wordpress-update-window-exploited-cisa-3-days

CISA added a flaw in WordPress itself to its catalogue of exploited vulnerabilities on 3 November, and gave US federal agencies until 6 November to fix it and to check whether they had already been compromised.[1][5] CVE-2026-119977 opens only while WordPress updates. In versions 4.7 to 7.1.3, a full-package core update uses “predictable, web-accessible staging paths” that let unauthenticated attackers “execute code on the server during the upgrade window”.[1] WordPress fixed it in 7.1.4 on 28 October, with releases for every older branch back to 4.7.[2][3]

18,500+

requests for staged installer paths in the first 21 hours of Wordfence's firewall rule

The first came nine minutes after the rule went live on 28 October. Two sources polled small groups of sites for about 14.5 hours.[4]

## A race the attacker runs again and again

**Figure: For a few seconds, an update leaves a copy of WordPress, installer included, where anyone can request it**

*How CVE-2026-119977 works in WordPress 4.7 to 7.1.3, and what 7.1.4 changed*

1. 01The update unpacksA full-package core update unpacks the new WordPress into a predictable folder under `wp-content/upgrade`.
2. 02The installer is exposedThe staged copy includes the installer, `setup-config.php`. On many servers that folder can be reached from the web.
3. 03The raceA request that reaches the installer before WordPress cleans up can lead to PHP code execution. No account needed.
4. 04The fix7.1.4 randomises the folder name, adds an index guard and stops unsafe promotion of staged configuration data.

Source: Wordfence, 29 October 2026; CISA KEV entry, 3 November 2026 · as of 4 November 2026

In Wordfence’s lab the folder stayed open “only seconds”. Wordfence rates the flaw 8.1 of 10 and calls the attack complexity high: the attacker needs a full-package update, web access to the folder, its path, and time to finish before cleanup. One request is unlikely to land; automated polling improves the odds, which is what Wordfence’s firewall saw. Its count is of requests to its customers’ sites, and not every one used the exact vulnerable path.[4]

## Who is exposed, and what is not known

WordPress runs 39.5% of all websites, by W3Techs’ count on 4 November.[6] Of the sites that report to WordPress.org, 65.2% run the 7.1 branch; 33.9% run 4.7 to 7.0 and need their own branch’s release; 1.0% run 4.6 or older, which get no security fixes at all.[7][3] WordPress.org does not publish how many are on 7.1.4 itself. No compromise has been confirmed in public: Wordfence reports attempts, and neither WordPress nor CISA names a victim.[1][4]

TechBag countTechBag count

In CISA’s feed (version 2026.11.03), WordPress core now has four entries, all added since 21 July: two chained flaws that day, one on 25 September and this one. Before July, its only entries under WordPress’s name were three plugins, added in November 2021.

## What to check

- **The version on your branch.** Dashboard, then Updates: 7.1.4, or your branch’s release (7.0.8, 6.9.11, 6.8.12, down to 4.7.39). Automatic background updates should have applied it; Wordfence advises checking rather than assuming.[3][4]
- **The logs, if a site stayed unpatched:** requests to PHP files under `wp-content/upgrade`, and administrators, plugins or PHP files you did not add.[4]
- **The firewall.** Wordfence’s paying customers got a rule at 20:30 UTC on 28 October, about three hours after the release; free users get it on 27 November. The exploit calls a PHP file directly, so a plugin firewall must run before that file loads (Wordfence’s “Extended Protection”). A rule does not replace the update.[4]

The same week brought a second update-path incident of a different kind. OPSSHIELD says an attacker used stolen credentials on 2 November to push a malicious script through the update channel of cPGuard, OPSSHIELD’s web-server security product (versions 5.88.12 to 5.88.19); the script collected password hashes and root SSH files. It asks customers to move to 5.88.25 and rotate credentials.[9]

In India: no CERT-In note yet, and a hacked site is a six-hour report

CERT-In’s ten vulnerability notes from 27 October to 4 November (CIVN-2026-0528 to 0537) do not cover this flaw, by our count. Its Directions of 28 April 2022 make “intrusion into a website” reportable within 6 hours of noticing.[8] The same WordPress release also updates its bundled root certificates “due to the eMudhra revocation”,[2] the Indian certificate authority whose emSign ECC root was distrusted in October; see [our piece on eMudhra](https://www.thetechbag.com/blog/emudhra-root-distrusted-in-100-minutes).

How we did this

Figures as of 4 November 2026, 7pm IST

Flaw details are WordPress’s, Wordfence’s and CISA’s. The attack figures are Wordfence’s alone; coverage quotes other counts that do not agree, and we do not use them. Branch shares are our sums of WordPress.org’s version statistics, which count only sites that report to it. The KEV due date binds US federal civilian agencies under BOD 26-04; how that clock works is in [our piece on CISA’s 3-day deadline](https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3).

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed (CVE-2026-119977 added 3 November, due 6 November)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — 3 November 2026
2. [WordPress.org, WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) — 28 October 2026
3. [WordPress.org Documentation, Version 7.1.4 (security fixes and branch releases)](https://wordpress.org/support/wordpress-version/version-7-1-4/) — 28 October 2026
4. [Wordfence, WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release](https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/) — 29 October 2026 Updated 30 October.
5. [CISA, BOD 26-04 implementation guidance (forensic triage)](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk) — 10 June 2026 Updated 25 August.
6. [W3Techs, Usage statistics of WordPress](https://w3techs.com/technologies/details/cm-wordpress) — 4 November 2026
7. [WordPress.org, version statistics API (share of sites by branch)](https://api.wordpress.org/stats/wordpress/1.0/) — read 4 November 2026
8. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (Annexure I, item iv)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
9. [OPSSHIELD, cPGuard security advisory: Update channel compromise](https://opsshield.com/notice/cpguard-update-channel-compromise.html) — 3 November 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [11,334 WordPress flaws in a year, and only six were in WordPress itself](https://www.thetechbag.com/blog/introduction-cms-tools-top-10-cms-platforms) — How rare a core flaw is: of 11,334 WordPress flaws in a year, only six were in WordPress itself, by Patchstack’s count.

Go deeper on TechBag

- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that find outdated WordPress installs and the plugins on them
- [Cloudflare application security](https://www.thetechbag.com/cloudflare/cloudflare-application-security) — a WAF in front of the site, which sees a direct request to a staged PHP file
- [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — tools that confirm updates actually landed across many servers